Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Spicy SSL analyzer: move unknown version out of possible range

Browse source 
This moves the negotiated version outside of the possible range of
protocol values. I don't think it was possible to cause a problem with
this in the past - but this approach seems safer.
This commit is contained in:
Johanna Amann 2025-06-26 17:06:43 +01:00
parent 2ce0d4f73b
commit 2bb47d8d9a
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/analyzer/protocol/ssl/spicy/SSL.spicy
View file

@ -177,7 +177,8 @@ type NameType = enum {
# anonymous = 0, rsa= 1, dsa= 2, ecdsa= 3
# };
const UNKNOWN_VERSION: uint16 = 0x0000;
# UNKNOWN_VERSION is outside the 16-bit range of real possible versions
const UNKNOWN_VERSION: uint32 = 0xFFFF0000;
const SSLv2 = 0x0002;
const SSLv3 = 0x0300;
const TLSv10 = 0x0301;
@ -567,7 +568,7 @@ type Share = unit {
# version as seen in server_hello (for signature and hash-alg choice)
var chosen_version_sh_outer: uint16;
# final negotiated version - can e.g. be used to distinguished tls 1.3
var negotiated_version: uint16;
var negotiated_version: uint32 = UNKNOWN_VERSION;
# set to true if chosen version is identified as a tls 1.3 version
var tls_13: bool;
var chosen_cipher: uint16;
@ -660,7 +661,7 @@ public type Message = unit {
sink handshakesink;
sink alertsink;
var record_version: uint16;
var record_version: uint32;
var dtls: bool = False;
var partial: bool = False;
var first_packet: bool = True; # needed for SSLv2, which sadly is quite stateful.